diff options
| author | Luca Barbato <lu_zero@gentoo.org> | 2013-08-13 07:28:41 +0200 |
|---|---|---|
| committer | Luca Barbato <lu_zero@gentoo.org> | 2013-08-13 14:04:55 +0200 |
| commit | 3562684db716d11de0b0dcc52748e9cd90d68132 (patch) | |
| tree | 6f9efb9cdeafff099d6038f8b0607fbbf463dc8c /libavformat/oggparsevorbis.c | |
| parent | f13fe6020e6a3871f9b0c96b240e58e6ed4fb5d7 (diff) | |
| download | ffmpeg-3562684db716d11de0b0dcc52748e9cd90d68132.tar.gz | |
ogg: Always alloc the private context in vorbis_header
It is possible to have an initial broken header and then valid packets.
Reported-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org
Diffstat (limited to 'libavformat/oggparsevorbis.c')
| -rw-r--r-- | libavformat/oggparsevorbis.c | 6 |
1 files changed, 3 insertions, 3 deletions
diff --git a/libavformat/oggparsevorbis.c b/libavformat/oggparsevorbis.c index db462fc865..adf8f0360a 100644 --- a/libavformat/oggparsevorbis.c +++ b/libavformat/oggparsevorbis.c @@ -212,15 +212,15 @@ vorbis_header (AVFormatContext * s, int idx) struct oggvorbis_private *priv; int pkt_type = os->buf[os->pstart]; - if (!(pkt_type & 1)) - return 0; - if (!os->private) { os->private = av_mallocz(sizeof(struct oggvorbis_private)); if (!os->private) return 0; } + if (!(pkt_type & 1)) + return 0; + if (os->psize < 1 || pkt_type > 5) return -1; |